The Symantec Endpoint Protection Manager home page shows "Security Status - Attention Needed" for "Sonar disabled" when the failure threshold set in preferences has not been exceeded. For example, on the SEPM home page under preferences > Security Status, you set "Percentage of Computers reporting Sonar Off" to 75%. You then connect two clients and disable Sonar on one of the clients. The failure ratio under View Details will report 50%, but the home page will still say "Attention Needed" instead of "Good."
Security Status - Attention Needed
Symantec is currently investigating this issue.
Symantec Endpoint Protection 12.1 RU5. This issue does not happen on 12.1 RU4 MP1.